.pre-commit-config.yaml

# Supply-chain rules for this file (2026-07 dependency review):
# - Remote hook revs are FROZEN commit SHAs, never mutable tags. Refresh
#   with `pre-commit autoupdate --freeze`.
# - ruff and mypy run via `uv run` (language: system) so their versions come
#   from uv.lock — one toolchain copy, Dependabot-maintained. Never re-add
#   the ruff-pre-commit / mirrors-mypy remote hooks: the two copies drift
#   (they had reached ruff v0.7.4 / mypy v1.13.0 against locked 0.15.20 /
#   2.2.0) and every remote hook repo is code executed on the dev machine.

default_language_version:
  python: python3.14

repos:
  # Whitespace + EOL hygiene
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # frozen: v5.0.0
    hooks:
      - id: end-of-file-fixer
      - id: trailing-whitespace
      - id: check-merge-conflict
      - id: check-yaml
      - id: check-toml
      - id: check-json
      - id: check-added-large-files
        args: ["--maxkb=1024"]
        exclude: ^uv\.lock$
      - id: mixed-line-ending
        args: ["--fix=lf"]

  # Ruff + mypy from uv.lock — same binaries CI runs, no drift.
  - repo: local
    hooks:
      - id: ruff
        name: ruff check (uv.lock version)
        language: system
        entry: uv run ruff check --fix --force-exclude
        types_or: [python, pyi]
        require_serial: true
      - id: ruff-format
        name: ruff format (uv.lock version)
        language: system
        entry: uv run ruff format --force-exclude
        types_or: [python, pyi]
        require_serial: true
      - id: mypy
        name: mypy strict (uv.lock version)
        language: system
        entry: uv run mypy custom_components/haggle
        files: ^custom_components/haggle/.*\.py$
        pass_filenames: false

  # Secret scanning
  - repo: https://github.com/gitleaks/gitleaks
    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # frozen: v8.30.1
    hooks:
      - id: gitleaks

  # Shell scripts — scripts/check_claude_coauthor.sh, scripts/wt (shebang-
  # detected), .claude/hooks/*.sh. Several implement repo controls (the
  # provenance trailer, the branch guard), so they get linted like code.
  - repo: https://github.com/shellcheck-py/shellcheck-py
    rev: 745eface02aef23e168a8afb6b5737818efbea95 # frozen: v0.11.0.1
    hooks:
      - id: shellcheck

  # GitHub Actions workflow lint. language: golang — pre-commit >= 3.0
  # bootstraps its own Go toolchain, no dev-machine Go install required.
  - repo: https://github.com/rhysd/actionlint
    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # frozen: v1.7.12
    hooks:
      - id: actionlint

  # Workflow security audit — zizmor from uv.lock (same anti-drift rule as
  # the ruff/mypy local hooks above; Dependabot maintains the version).
  # --offline: online audits need GitHub API access; offline covers all the
  # rules we gate on. Threshold mirrors the CI step exactly.
  - repo: local
    hooks:
      - id: zizmor
        name: zizmor (uv.lock version)
        language: system
        entry: uv run zizmor --offline --min-severity medium
        files: ^\.github/workflows/.*\.ya?ml$
        require_serial: true

  # Conventional Commits
  - repo: https://github.com/compilerla/conventional-pre-commit
    rev: fab6a95091c567b872099a98cad586c122f55dc8 # frozen: v3.6.0
    hooks:
      - id: conventional-pre-commit
        stages: [commit-msg]
        args: ["--strict"]

  # Local: every commit must carry a Co-Authored-By: Claude trailer.
  # The repo is purely AI-generated; provenance is mandatory.
  - repo: local
    hooks:
      - id: require-claude-coauthor
        name: Require Co-Authored-By Claude trailer
        language: script
        entry: scripts/check_claude_coauthor.sh
        stages: [commit-msg]

  # Codex Security (@openai/codex-security) — LLM-based vulnerability scan,
  # not static analysis. OPT-IN and pre-push ONLY: a bare `pre-commit
  # install` (the standard onboarding step) does NOT wire this in, so a
  # contributor without an OpenAI/ChatGPT account is never blocked from
  # committing or pushing. To opt in on a machine that already has
  # `@openai/codex-security` installed and authenticated
  # (`npx --no-install @openai/codex-security login`):
  #   pre-commit install --hook-type pre-push
  # Scans the diff against origin/main — i.e. what a PR opened from this
  # branch would contain — not the full repository; see AGENTS.md's AI
  # toolchain table for the separate periodic full-codebase audit. Skip a
  # single push with the framework's standard mechanism:
  #   SKIP=codex-security git push
  # Unlike every other hook in this file, this tool is NOT version-pinned —
  # it is personal global tooling (`~/node_modules`), not a repo dependency
  # declared in uv.lock/pyproject.toml, so there is no lockfile-equivalent
  # to freeze it against. Adopted 2026-08 per SECURITY.md's "Adopting a new
  # dependency" gate: registry provenance verified (scoped `@openai`
  # package, maintainers on `@openai.com`, published via GitHub Actions
  # OIDC), Apache-2.0 licence (compatible). Do NOT wire this into CI — it
  # would require a stored `OPENAI_API_KEY`/`CODEX_API_KEY` secret, which
  # violates this repo's zero-standing-secrets invariant (SECURITY.md §
  # Access Review: "Actions secrets == 0").
  - repo: local
    hooks:
      - id: codex-security
        name: Codex Security scan (diff vs origin/main)
        language: system
        entry: npx --no-install @openai/codex-security scan . --diff origin/main --fail-on-severity high --max-cost 2
        pass_filenames: false
        stages: [pre-push]